https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-best-block-portable-apps/m-p/540282#M4233 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/180285">@Kahlilp</a>&nbsp;</P> <P><BR />Thank you for writing to live community!</P> <P>You may block<SPAN>&nbsp;a file/application from running on any of your endpoints in either way i.e.&nbsp;</SPAN></P> <P><SPAN>1. By adding the&nbsp;associated hash to the <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File-Execution" target="_self">block list</A> but with new version of application, hash might change and thus application will not be blocked as application Hash would need to be updated.</SPAN></P> <P><SPAN>2. By using BIOC restrictions and in BIOC restrictions to adapt with Hash change you may use the Digital Signature or Vendor Signature. You may refer to this <A href="https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/blocking-file-execution-based-on-nameand-or-bioc-ioc/td-p/441563" target="_self">thread</A> for more details.&nbsp;&nbsp;</SPAN></P> <P>&nbsp;</P> <P>Hope this helps!</P> <P>Please mark the response as "Accept as Solution" if it answers your query.</P> <P><BR />Regards.</P> Thu, 27 Apr 2023 04:08:49 GMT PiyushKohli 2023-04-27T04:08:49Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-best-block-portable-apps/m-p/540207#M4230 <P>Has anyone successfully implemented in their environment? Do you do it by BIOC Restrictions, using digital signatures, file path or executable name?</P> Wed, 26 Apr 2023 14:29:32 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-best-block-portable-apps/m-p/540207#M4230 Kahlilp 2023-04-26T14:29:32Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-best-block-portable-apps/m-p/540282#M4233 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/180285">@Kahlilp</a>&nbsp;</P> <P><BR />Thank you for writing to live community!</P> <P>You may block<SPAN>&nbsp;a file/application from running on any of your endpoints in either way i.e.&nbsp;</SPAN></P> <P><SPAN>1. By adding the&nbsp;associated hash to the <A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File-Execution" target="_self">block list</A> but with new version of application, hash might change and thus application will not be blocked as application Hash would need to be updated.</SPAN></P> <P><SPAN>2. By using BIOC restrictions and in BIOC restrictions to adapt with Hash change you may use the Digital Signature or Vendor Signature. You may refer to this <A href="https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/blocking-file-execution-based-on-nameand-or-bioc-ioc/td-p/441563" target="_self">thread</A> for more details.&nbsp;&nbsp;</SPAN></P> <P>&nbsp;</P> <P>Hope this helps!</P> <P>Please mark the response as "Accept as Solution" if it answers your query.</P> <P><BR />Regards.</P> Thu, 27 Apr 2023 04:08:49 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-best-block-portable-apps/m-p/540282#M4233 PiyushKohli 2023-04-27T04:08:49Z